MIFARE DESFire
NXP's AES smart card — a tiny file system with a lock on every drawer. The usual right answer to "what should we migrate to?", if you manage the keys.
MIFARE DESFire is NXP's grown-up card, and it's a different animal from MIFARE Classic. Instead of a flat block of memory, a DESFire card is a small file system, and instead of a cracked in-house cipher it uses real, published cryptography. It's the card behind a huge share of modern transit, campus and building access.
#A file system with locks
A DESFire card holds up to 28 applications — think folders — and each application holds files: plain data, a counter for a balance, a log of the last few taps. The transit operator, the campus and the office vending machine can each have their own application on one card, walled off from the others.
Every application and file is protected by keys, and getting at one means a mutual authentication: the card proves it has the key, the reader proves it has the key, and they derive a fresh APDU session that's encrypted for the rest of the conversation. Nothing useful goes across the air in the clear. This is the same shape as a bank card, scaled down.
#Generations, and the one real scare
DESFire has moved forward in steps:
| Generation | Crypto | Notes |
|---|---|---|
| original (D40) | 3DES | the 2002 chip; see below |
| EV1 | 3DES / AES | added AES, hardened |
| EV2 | AES | transaction integrity, proximity check |
| EV3 | AES | current; the default to spec today |
The original DESFire chip had a genuine break: in 2011, researchers (Oswald and Paar) pulled its 3DES key using a side-channel attack — watching the chip's power use while it worked, rather than beating the maths. It mattered, and it's why nobody should deploy the original D40 now. EV1 onward were hardened against it, and AES on EV2/EV3 has held up.
#It's only as good as your keys
A DESFire card on factory default keys is an expensive MIFARE Classic — the crypto is sound and the front door is wide open. The thing that actually makes a deployment safe is diversified keys: each card's key is derived from a site master key plus the card's UID, so recovering one card's key gets you that one card and nothing else. Get this wrong — default keys, or one key shared across every card — and the maths can't save you. More in Why old cards are a bad idea.
#What's next
DESFire still rests on a shared secret: the reader has to hold key material to check a card, so every reader is a place the site's keys live. MIFARE DUOX (2024) keeps the DESFire model but adds public-key crypto on top, so readers can verify a card without holding anything that could make one. For most buildings, though, "DESFire EV3 with diversified keys" is still the practical, boring, correct answer.
With Your phone
NXP TagInfo (Android) identifies a DESFire card, its generation and the applications it advertises — a nice way to see the file-system model on a card you own. The file contents stay locked behind the keys.